yuyx
b9edc4aaa2
安全修复清单: 1. 验证码改为图片方式返回，防止明文泄露 2. CORS配置从环境变量读取，不再使用通配符"*" 3. VIP API添加@admin_required装饰器，统一认证 4. 用户登录统一错误消息，防止用户枚举 5. IP限流不再信任X-Forwarded-For头，防止伪造绕过 6. 密码强度要求提升(8位+字母+数字) 7. 日志不���记录完整session/cookie内容，防止敏感信息泄露 8. XSS防护：日志输出和Bug反馈内容转义HTML 9. SQL注入防护：LIKE查询参数转义 10. 路径遍历防护：截图目录白名单验证 11. 验证码重放防护：验证前删除验证码 12. 数据库连接池健康检查 13. 正则DoS防护：限制数字匹配长度 14. Account类密码私有化，__repr__不暴露密码 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
275 lines
9.1 KiB
HTML
275 lines
9.1 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="zh-CN">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>用户注册 - 知识管理平台</title>
|
|
<style>
|
|
* {
|
|
margin: 0;
|
|
padding: 0;
|
|
box-sizing: border-box;
|
|
}
|
|
|
|
body {
|
|
font-family: 'Microsoft YaHei', Arial, sans-serif;
|
|
background: linear-gradient(135deg, #56CCF2 0%, #2F80ED 100%);
|
|
min-height: 100vh;
|
|
display: flex;
|
|
justify-content: center;
|
|
align-items: center;
|
|
}
|
|
|
|
.register-container {
|
|
background: white;
|
|
border-radius: 10px;
|
|
box-shadow: 0 10px 40px rgba(0,0,0,0.2);
|
|
width: 400px;
|
|
padding: 40px;
|
|
}
|
|
|
|
.register-header {
|
|
text-align: center;
|
|
margin-bottom: 30px;
|
|
}
|
|
|
|
.register-header h1 {
|
|
font-size: 28px;
|
|
color: #333;
|
|
margin-bottom: 10px;
|
|
}
|
|
|
|
.register-header p {
|
|
color: #666;
|
|
font-size: 14px;
|
|
}
|
|
|
|
.form-group {
|
|
margin-bottom: 20px;
|
|
}
|
|
|
|
.form-group label {
|
|
display: block;
|
|
margin-bottom: 8px;
|
|
color: #333;
|
|
font-weight: bold;
|
|
}
|
|
|
|
.form-group input {
|
|
width: 100%;
|
|
padding: 12px;
|
|
border: 1px solid #ddd;
|
|
border-radius: 5px;
|
|
font-size: 14px;
|
|
transition: border-color 0.3s;
|
|
}
|
|
|
|
.form-group input:focus {
|
|
outline: none;
|
|
border-color: #2F80ED;
|
|
}
|
|
|
|
.form-group small {
|
|
color: #888;
|
|
font-size: 12px;
|
|
display: block;
|
|
margin-top: 5px;
|
|
}
|
|
|
|
.btn-register {
|
|
width: 100%;
|
|
padding: 12px;
|
|
background: linear-gradient(135deg, #56CCF2 0%, #2F80ED 100%);
|
|
color: white;
|
|
border: none;
|
|
border-radius: 5px;
|
|
font-size: 16px;
|
|
font-weight: bold;
|
|
cursor: pointer;
|
|
transition: transform 0.2s;
|
|
}
|
|
|
|
.btn-register:hover {
|
|
transform: translateY(-2px);
|
|
}
|
|
|
|
.btn-register:active {
|
|
transform: translateY(0);
|
|
}
|
|
|
|
.login-link {
|
|
text-align: center;
|
|
margin-top: 20px;
|
|
color: #666;
|
|
}
|
|
|
|
.login-link a {
|
|
color: #2F80ED;
|
|
text-decoration: none;
|
|
font-weight: bold;
|
|
}
|
|
|
|
.login-link a:hover {
|
|
text-decoration: underline;
|
|
}
|
|
|
|
.error-message {
|
|
background: #ffe6e6;
|
|
color: #d63031;
|
|
padding: 10px;
|
|
border-radius: 5px;
|
|
margin-bottom: 20px;
|
|
display: none;
|
|
}
|
|
|
|
.success-message {
|
|
background: #e6ffe6;
|
|
color: #27ae60;
|
|
padding: 10px;
|
|
border-radius: 5px;
|
|
margin-bottom: 20px;
|
|
display: none;
|
|
}
|
|
|
|
@media (max-width: 480px) {
|
|
body { padding: 12px; align-items: flex-start; padding-top: 20px; }
|
|
.register-container { width: 100%; max-width: 100%; padding: 24px 20px; }
|
|
.register-header h1 { font-size: 24px; }
|
|
.register-header p { font-size: 13px; }
|
|
.form-group { margin-bottom: 18px; }
|
|
.form-group label { font-size: 13px; }
|
|
.form-group input { padding: 11px; font-size: 16px; } /* iOS防止自动缩放 */
|
|
.form-group small { font-size: 11px; }
|
|
.btn-register { padding: 13px; font-size: 15px; }
|
|
.login-link { margin-top: 16px; font-size: 14px; }
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="register-container">
|
|
<div class="register-header">
|
|
<h1>用户注册</h1>
|
|
</div>
|
|
|
|
<div id="errorMessage" class="error-message"></div>
|
|
<div id="successMessage" class="success-message"></div>
|
|
|
|
<form id="registerForm" onsubmit="handleRegister(event)">
|
|
<div class="form-group">
|
|
<label for="username">用户名 *</label>
|
|
<input type="text" id="username" name="username" required minlength="3">
|
|
<small>至少3个字符</small>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="password">密码 *</label>
|
|
<input type="password" id="password" name="password" required minlength="6">
|
|
<small>至少6个字符</small>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="confirm_password">确认密码 *</label>
|
|
<input type="password" id="confirm_password" name="confirm_password" required>
|
|
</div>
|
|
|
|
<div class="form-group">
|
|
<label for="email">邮箱</label>
|
|
<input type="email" id="email" name="email">
|
|
<small>选填，用于接收审核通知</small>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="captcha">验证码</label>
|
|
<div style="display: flex; gap: 10px; align-items: center;">
|
|
<input type="text" id="captcha" placeholder="请输入验证码" required style="flex: 1;">
|
|
<img id="captchaImage" src="" alt="验证码" style="height: 40px; border: 1px solid #ddd; border-radius: 4px; cursor: pointer;" onclick="refreshCaptcha()" title="点击刷新">
|
|
<button type="button" onclick="refreshCaptcha()" style="padding: 8px 15px; background: #f0f0f0; border: 1px solid #ddd; border-radius: 4px; cursor: pointer;">刷新</button>
|
|
</div>
|
|
</div>
|
|
|
|
<button type="submit" class="btn-register">注册</button>
|
|
</form>
|
|
|
|
<div class="login-link">
|
|
已有账号？ <a href="/login">立即登录</a>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
let captchaSession = '';
|
|
window.onload = function() { generateCaptcha(); };
|
|
async function handleRegister(event) {
|
|
event.preventDefault();
|
|
|
|
const username = document.getElementById('username').value.trim();
|
|
const password = document.getElementById('password').value.trim();
|
|
const confirmPassword = document.getElementById('confirm_password').value.trim();
|
|
const email = document.getElementById('email').value.trim();
|
|
const errorDiv = document.getElementById('errorMessage');
|
|
const successDiv = document.getElementById('successMessage');
|
|
|
|
errorDiv.style.display = 'none';
|
|
successDiv.style.display = 'none';
|
|
|
|
// 验证
|
|
if (username.length < 3) {
|
|
errorDiv.textContent = '用户名至少3个字符';
|
|
errorDiv.style.display = 'block';
|
|
return;
|
|
}
|
|
|
|
if (password.length < 6) {
|
|
errorDiv.textContent = '密码至少6个字符';
|
|
errorDiv.style.display = 'block';
|
|
return;
|
|
}
|
|
|
|
if (password !== confirmPassword) {
|
|
errorDiv.textContent = '两次输入的密码不一致';
|
|
errorDiv.style.display = 'block';
|
|
return;
|
|
}
|
|
|
|
try {
|
|
const response = await fetch('/api/register', {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json'
|
|
},
|
|
body: JSON.stringify({ username, password, email, captcha_session: captchaSession, captcha: document.getElementById('captcha').value.trim() })
|
|
});
|
|
|
|
const data = await response.json();
|
|
|
|
if (response.ok) {
|
|
successDiv.textContent = data.message || '注册成功，请等待管理员审核';
|
|
successDiv.style.display = 'block';
|
|
|
|
// 清空表单
|
|
document.getElementById('registerForm').reset();
|
|
|
|
// 3秒后跳转到登录页
|
|
setTimeout(() => {
|
|
window.location.href = '/login';
|
|
}, 3000);
|
|
} else {
|
|
errorDiv.textContent = data.error || '注册失败';
|
|
errorDiv.style.display = 'block';
|
|
}
|
|
} catch (error) {
|
|
errorDiv.textContent = '网络错误，请稍后重试';
|
|
errorDiv.style.display = 'block';
|
|
}
|
|
}
|
|
async function generateCaptcha() {
|
|
const resp = await fetch('/api/generate_captcha', {method: 'POST', headers: {'Content-Type': 'application/json'}});
|
|
const data = await resp.json();
|
|
if (data.session_id && data.captcha_image) {
|
|
captchaSession = data.session_id;
|
|
document.getElementById('captchaImage').src = data.captcha_image;
|
|
}
|
|
}
|
|
async function refreshCaptcha() { await generateCaptcha(); document.getElementById('captcha').value = ''; }
|
|
</script>
|
|
</body>
|
|
</html>
|